Export Conditional Access named locations

#Requires -Modules Microsoft.Graph.Authentication
# Conditional Access named locations: IP ranges, countries and trusted flags. Read-only (GET requests only).
param(
    [string]$Path = (Join-Path -Path (Get-Location).Path -ChildPath 'named-locations.json')
)

Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome

$locations = @()
$uri = '/v1.0/identity/conditionalAccess/namedLocations'
while ($uri) {
    $page = Invoke-MgGraphRequest -Method GET -Uri $uri
    $locations += $page['value']
    $uri = $page['@odata.nextLink']
}

$locations | ConvertTo-Json -Depth 10 | Out-File -FilePath $Path -Encoding utf8

foreach ($location in $locations) {
    $isIpRange = $location['@odata.type'] -eq '#microsoft.graph.ipNamedLocation'
    if ($isIpRange) {
        $entries = ($location['ipRanges'] | ForEach-Object { $_['cidrAddress'] }) -join ', '
    } else {
        $entries = $location['countriesAndRegions'] -join ', '
    }
    [pscustomobject]@{
        Name             = $location['displayName']
        Type             = if ($isIpRange) { 'IP ranges' } else { 'Countries/regions' }
        Trusted          = $location['isTrusted']
        Entries          = $entries
        IncludeUnknown   = $location['includeUnknownCountriesAndRegions']
        ModifiedDateTime = $location['modifiedDateTime']
    }
}
Write-Output "Saved $($locations.Count) named locations to $Path"

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

• Reads the locations with GET requests, so every property comes back exactly as the ipNamedLocation and countryNamedLocation resources document it.
• Writes one local file (default: named-locations.json in the current folder). Nothing in the tenant changes. Pass -Path to choose the file.
• Trusted applies to IP range locations only. Policies that exclude trusted locations treat sign-ins from those ranges as lower risk, so every trusted range should be one you own.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.